3. The processing of these data concerning personnel in the service of the responsible party shall
take place in accordance with the rules established in compliance with the procedure referred to
in the Works Councils Act (Wet op de ondernemingsraden).
4. The prohibition does not apply where these data are processed for the account of third parties:
a. by responsible parties acting in accordance with a licence issued under the Private Security
Organisations and Investigation Bureaus Act (Wet particuliere beveiligingsorganisaties en
recherchebureaus);
b. where these third parties are legal persons forming part of the same group, as referred to in
Article 2:24(b) of the Civil Code, or
c. where appropriate and specific guarantees have been provided and the procedure referred to
in Article 31 has been followed.
5. The prohibition on processing other personal data, as referred to in Article 16, does not apply
where this is necessary to supplement the processing of data on criminal behaviour, for the
purposes for which these data are being processed.
6. The provisions of (2) to (5) are likewise applicable to personal data relating to a ban imposed
by a court concerning unlawful or objectionable conduct.
7. Rules may be issued by general administrative regulation concerning the appropriate and
specific guarantees referred to under (4)(c).
Article 23
1. Without prejudice to Articles 17 to 22, the prohibition on processing personal data referred to
in Article 16 does not apply where:
a. this is carried out with the express consent of the data subject;
b. the data have manifestly been made public by the data subject;
c. this is necessary for the establishment, exercise or defence of a right in law;
d. this is necessary to comply with an obligation of international public law, or
e. this is necessary with a view to an important public interest, where appropriate guarantees
have been put in place to protect individual privacy and this is provided for by law or else the
Data Protection Commission has granted an exemption. When granting an exemption, the
Commission can impose rules and restrictions.
2. The prohibition on the processing of personal data referred to in Article 16 for the purpose of
scientific research or statistics does not apply where:
a. the research serves a public interest,
b. the processing is necessary for the research or statistics concerned,